Update auth/security.py

auth/security.py

@@ -3,120 +3,135 @@ from datetime import datetime, timedelta, timezone
 from typing import Optional, Dict, Any
 
 from jose import jwt, JWTError
+from passlib.context import CryptContext
 from fastapi import HTTPException, status, Depends
 from fastapi.security import OAuth2PasswordBearer
 
-from passlib.context import CryptContext
-
 
 # =========================================================
-# CONFIG (ENV-FIRST SECURITY MODEL)
+# ENV CONFIG
 # =========================================================
 
 SECRET_KEY = os.getenv("SECRET_KEY")
-ALGORITHM = os.getenv("ALGORITHM", "HS256")
-ACCESS_TOKEN_EXPIRE_MINUTES = int(os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", "1440"))
 
 if not SECRET_KEY:
-    raise RuntimeError("SECRET_KEY is not set in environment variables")
+    raise RuntimeError("SECRET_KEY environment variable missing")
+
+ALGORITHM = os.getenv("ALGORITHM", "HS256")
+
+ACCESS_TOKEN_EXPIRE_MINUTES = int(
+    os.getenv("ACCESS_TOKEN_EXPIRE_MINUTES", "1440")
+)
 
 
 # =========================================================
-# PASSWORD HASHING (FIXED - NO BCRYPT)
+# PASSWORD HASHING
+# =========================================================
+# IMPORTANT:
+# pbkdf2_sha256 avoids:
+# - bcrypt crashes
+# - bcrypt native dependency issues
+# - 72-byte limits
+# - passlib backend bugs
 # =========================================================
-# Why this change:
-# - bcrypt is broken in your runtime (passlib backend + __about__ bug)
-# - bcrypt has 72-byte limitation causing signup crashes
-# - argon2 is modern, memory-hard, and production safe
 
 pwd_context = CryptContext(
-    schemes=["argon2"],
+    schemes=["pbkdf2_sha256"],
     deprecated="auto",
-    argon2__time_cost=2,
-    argon2__memory_cost=102400,
-    argon2__parallelism=8,
 )
 
 
 def hash_password(password: str) -> str:
-    if not isinstance(password, str) or not password.strip():
-        raise ValueError("Invalid password input")
+
+    if not password:
+        raise ValueError("Password required")
+
+    if len(password) < 8:
+        raise ValueError("Password too short")
 
     return pwd_context.hash(password)
 
 
-def verify_password(plain_password: str, hashed_password: str) -> bool:
-    if not plain_password or not hashed_password:
-        return False
+def verify_password(
+    plain_password: str,
+    hashed_password: str,
+) -> bool:
 
     try:
-        return pwd_context.verify(plain_password, hashed_password)
+        return pwd_context.verify(
+            plain_password,
+            hashed_password,
+        )
     except Exception:
         return False
 
 
 # =========================================================
-# JWT HANDLING
+# JWT
 # =========================================================
 
 def create_access_token(
     data: Dict[str, Any],
-    expires_delta: Optional[timedelta] = None
+    expires_delta: Optional[timedelta] = None,
 ) -> str:
 
     to_encode = data.copy()
 
     expire = datetime.now(timezone.utc) + (
-        expires_delta or timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
+        expires_delta
+        if expires_delta
+        else timedelta(minutes=ACCESS_TOKEN_EXPIRE_MINUTES)
     )
 
     to_encode.update({"exp": expire})
 
-    return jwt.encode(to_encode, SECRET_KEY, algorithm=ALGORITHM)
+    return jwt.encode(
+        to_encode,
+        SECRET_KEY,
+        algorithm=ALGORITHM,
+    )
+
 
+def decode_token(token: str):
 
-def decode_token(token: str) -> Dict[str, Any]:
     try:
-        return jwt.decode(token, SECRET_KEY, algorithms=[ALGORITHM])
+        return jwt.decode(
+            token,
+            SECRET_KEY,
+            algorithms=[ALGORITHM],
+        )
+
     except JWTError:
+
         raise HTTPException(
             status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Invalid or expired authentication token",
+            detail="Invalid token",
             headers={"WWW-Authenticate": "Bearer"},
         )
 
 
 # =========================================================
-# FASTAPI AUTH DEPENDENCY
+# AUTH DEPENDENCY
 # =========================================================
 
-oauth2_scheme = OAuth2PasswordBearer(tokenUrl="/api/auth/login")
+oauth2_scheme = OAuth2PasswordBearer(
+    tokenUrl="/api/auth/login"
+)
+
 
+def get_current_user(
+    token: str = Depends(oauth2_scheme)
+):
 
-def get_current_user(token: str = Depends(oauth2_scheme)) -> Dict[str, Any]:
     payload = decode_token(token)
 
     user_id = payload.get("sub")
 
     if not user_id:
+
         raise HTTPException(
-            status_code=status.HTTP_401_UNAUTHORIZED,
-            detail="Invalid authentication payload",
+            status_code=401,
+            detail="Invalid authentication",
         )
 
-    return payload
-
-
-# =========================================================
-# PASSWORD POLICY (HARDENED)
-# =========================================================
-
-def validate_password_strength(password: str) -> None:
-    if len(password) < 8:
-        raise ValueError("Password must be at least 8 characters")
-
-    if password.isdigit():
-        raise ValueError("Password cannot be only numeric")
-
-    if password.lower() in {"password", "12345678", "qwerty"}:
-        raise ValueError("Password is too weak")
+    return payload